fix(pin): the work after a PIN and the change queue run in steps

After a correct or new PIN, promoting pending entries and applying waiting
"Require PIN" changes ran in the event of the last PBKDF2 step; 16 waiting
changes tripped the watchdog on the Forerunner 70. ChangeQueue.LockJob now
does it in steps while the PIN screen shows "Checking...", saves what it did
to the results and refreshes the glance after Set PIN too.

The list title decrypted every waiting change at each start. Queue items
are now [action, box] (aad OTPW-Q-2 + action code), so they are counted
without decrypting; 0.9.0 items are still read. A replacement is checked
when it arrives and its material is sealed apart (qm.<n>). Large buffers
are wiped and UTF-8-checked in pieces (Jobs.Wiper, Bytes.utf8Prefix,
SealedBox.openKeep/sealKeep). "Phone changes" reads behind "Reading...",
and Confirm all / Reject all act only on the changes shown. Storage full
no longer stops the app at the PIN.

Found by the review of b8addc8/096b5a4 and a new make watchdog test; the
diff was reviewed again and its findings fixed. fr70: make lint, make test
(176), make watchdog (19 cases at two steps per event), make screenshots
pass; list_locked and list_reset goldens show "Results ready (menu)".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 26 insertions, 0 deletions

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc7d9fa..42571b4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,32 @@ All notable changes to this project are documented here. The format follows
   a wrong PIN. Tap the OK key instead.
 - "Change PIN" with a PIN from 0.8.0 or earlier asked for the new PIN
   twice: the new 4-digit PIN after the unlock is now the change.
+- Entering the PIN could stop the app (watchdog) when changes from the
+  phone were waiting: in 0.9.0, 16 waiting "Require PIN" changes were
+  enough on the Forerunner 70. After the PIN, pending locked entries are
+  promoted and "Require PIN" changes applied in small steps while the PIN
+  screen shows "Checking…". What was applied, or why not, appears under
+  "Results ready" in the menu, and the glance also refreshes after a PIN
+  is set.
+- Waiting phone changes are counted without decrypting them, so a large
+  waiting replacement can no longer stop the app at start. "Phone changes"
+  reads its list behind a short "Reading…" screen.
+- A replacement secret or code contents is checked when it arrives: an
+  invalid one is refused at once instead of failing after the PIN. Valid
+  contents are stored apart from the queue and deleted with their change;
+  replacing a code with 4 KB of contents runs in steps throughout. Changes
+  queued by 0.9.0 are still read.
+- "Confirm all" could apply changes that arrived from the phone after
+  the list was shown. "Confirm all" and "Reject all" now act only on the
+  changes shown; later ones keep waiting.
+- With storage full, every correct PIN stopped the app while promoting
+  pending entries; it now reports "Storage full" and continues.
+
+### Tests
+
+- `make watchdog` also runs the work after a PIN (150 entries pending, 16
+  "Require PIN" waiting), reading the change queue and a 4 KB code
+  replacement (also one queued by 0.9.0), at twice the work per step.
 
 ## [0.9.0] - 2026-10-25